security-disaster-recovery practice questions

The hard drive on the file server has failed

Why wrong: Hard drive failure would cause hardware errors or I/O errors, not a missing catalog files error.

The backup software is not compatible with the current OS version

Why wrong: Incompatibility would typically cause an initial backup or restore failure, not a missing catalog error.

The full backup media is corrupted

Why wrong: Corrupted full backup media would likely produce a read error, not a missing catalog files error.

Pay the ransom to decrypt the differential backup

Why wrong: Paying the ransom is not a recommended security practice and may not result in decryption.

Reinstall the operating system and restore files from cloud storage

Why wrong: There is no indication that cloud storage is available, and this would not utilize existing backups.

Restore using only Wednesday's differential backup

Why wrong: Differential backups require the last full backup to be restored first; they are incremental from the full, not standalone.

Implement a RAID 5 array instead of RAID 1 for better redundancy.

Why wrong: RAID 5 provides fault tolerance but does not protect against backup corruption or accidental data loss. The problem is the backup was not verified, not the RAID level.

Document the backup procedure and create a disaster recovery plan.

Why wrong: Documentation is important but does not ensure backups are restorable. Without testing, the corruption would remain undetected.

Use a cloud-based backup service with offsite storage.

Why wrong: Offsite backup is beneficial but does not directly address the need to verify backup integrity. Regular testing is still required even with cloud backups.

Configure RAID 10 on all database servers to improve disk performance.

Why wrong: RAID 10 improves disk I/O and fault tolerance but does not address the need for more frequent backups or point-in-time recovery.

Upgrade the WAN connection between sites to reduce backup transfer times.

Why wrong: A faster connection would not change the daily backup schedule. The RPO requires more frequent backups, not just faster ones.

Adjust the RTO to 8 hours to allow for more comprehensive backups.

Why wrong: Changing the RTO does not resolve the RPO issue. The problem is data loss exceeding the allowed RPO, not the speed of recovery.

Encrypt all backup data at rest and in transit.

Why wrong: Encryption protects confidentiality but does not prevent destruction or modification of the backup data. Ransomware can encrypt already-encrypted files, making them unrecoverable.

Require multi-factor authentication for the backup service account.

Why wrong: MFA adds security but if the ransomware gains access through the account (e.g., via a compromised client), it can still encrypt backups. Immutable storage is needed.

Air-gap the backup repository by disconnecting it from the network except during backup windows.

Why wrong: Air-gapping helps but is not foolproof; if the backup server is compromised during the window, ransomware can still spread. Immutability is a stronger safeguard.

The cluster will automatically fail over to a third site because the witness server is unavailable.

Why wrong: There is no third site; the witness is only a file share, not a failover target.

The cluster continues operating because the nodes can use a dynamic quorum and adjust the vote count.

Why wrong: Dynamic quorum can adjust votes, but if all nodes and the witness are down, there are no votes to adjust.

The cluster remains online because the nodes can communicate directly and form quorum without the witness.

Why wrong: A two-node cluster without a witness cannot achieve quorum if one node fails; if both nodes are down, neither can vote.

Configure the network share with SMB encryption only.

Why wrong: SMB encryption secures data in transit, but the files remain unencrypted at rest on the backup server.

Use a dedicated NIC for backup traffic on an isolated VLAN.

Why wrong: Isolating traffic does not provide encryption; data remains in cleartext during transfer and at rest.

Place the backup server in a physically locked cage with restricted access.

Why wrong: Physical access controls do not encrypt the data; an attacker with network access could still intercept or read the files.

RAID controller

Why wrong: RAID controller issues might present as disk array failures or rebuild logs, not specific medium errors on a single drive.

RAM module

Why wrong: Faulty RAM typically causes memory parity errors or kernel panics, not I/O errors with sense key reporting.

Power supply

Why wrong: Power supply failures often generate power-related log entries (e.g., voltage warnings), not disk I/O errors.

Alternate processing site

Why wrong: This generic term could refer to any off-site facility; it is not a defined DR site type.

Cold site

Why wrong: A cold site is just space and would take days or weeks to set up.

Hot site

Why wrong: A hot site is fully equipped for immediate takeover, which exceeds the requirement and costs more.

Restore Sunday full, then Tuesday and Wednesday incrementals.

Why wrong: Missing Monday’s incremental backup, which contains changes from Monday that are not captured in Tuesday or Wednesday’s backups.

Restore Sunday full and Wednesday incremental only.

Why wrong: Skipping Monday and Tuesday incrementals would miss changes made on those days, resulting in data loss or corruption.

Restore Wednesday's incremental, then Sunday full.

Why wrong: Restoring an incremental before its parent full backup will fail or result in inconsistent data, as incrementals depend on the full backup.

A warm site with asynchronous replication.

Why wrong: Warm sites require time to activate and may lose data that hasn't been replicated since the last sync, resulting in a non-zero RPO.

A cloud-based site with daily snapshots.

Why wrong: Daily snapshots introduce a Recovery Point Objective (RPO) of up to 24 hours, meaning potential data loss of up to a full day.

A cold site with tape restoration.

Why wrong: Cold sites require hardware setup and tape restoration, leading to significant downtime and data loss up to the last backup.

Password-protect the tapes and keep them in a locked safe.

Why wrong: Password protection is weak and can be circumvented; a safe may be broken into; data on the tapes would still be readable if extracted.

Store tapes in a fireproof safe and limit access to key personnel.

Why wrong: Limiting access reduces risk but insiders or forced entry could still lead to theft; data on tapes remains unencrypted and readable.

Use a bonded courier service for transportation.

Why wrong: This only secures the tapes during transit, not while stored at the offsite facility. It does not prevent data access if tapes are stolen later.

The backup server is powered off.

Why wrong: If the server were off, the error message would indicate that the network path could not be found or the host is unreachable, not an 'Access is denied' error.

The network link is down.

Why wrong: A down network link would result in a connectivity error like 'Network path not found', not an access denial.

The backup file path exceeds the maximum length.

Why wrong: A path too long would trigger a specific error about file name or path length limits, not an access denied message.

The INPUT policy is set to ACCEPT.

Why wrong: Although the default policy is ACCEPT, the explicit DROP rule at the end of the chain overrides it for all packets not matching earlier rules.

The NAS device uses a different subnet.

Why wrong: Subnet addressing is a network configuration issue, not a local firewall rule; the firewall is dropping packets regardless of source/destination subnet.

The SSH ACCEPT rule is allowing traffic.

Why wrong: The SSH rule correctly permits port 22 traffic but does not interfere with port 10000 traffic.

Continuous data protection (CDP) with synchronous replication.

Why wrong: CDP provides near-zero RPO but introduces significant performance overhead due to constant replication, which is overkill for a 4-hour RPO requirement.

A weekly full backup with daily differential backups.

Why wrong: Differential backups capture all changes since the last full backup, and while they can restore faster, the backup window may not guarantee a 4-hour RPO, and differential size grows over time, impacting performance.

A nightly full backup.

Why wrong: A full backup every night would have up to a 24-hour gap between backups, failing to meet the 4-hour RPO if a failure occurs late in the day.

Cold site with no pre-configured hardware.

Why wrong: While traditionally considered cheap, a cold site still requires physical space and equipment procurement during a disaster; cloud DR can be more cost-effective with less management overhead.

Hot site with real-time replication.

Why wrong: A hot site maintains fully mirroring infrastructure, making it the most expensive option and unsuitable for a limited budget with high downtime tolerance.

Warm site with pre-installed hardware but no data.

Why wrong: A warm site requires hardware that is installed and partially configured, incurring moderate ongoing costs without the benefit of immediate failover.

Restore the server from the latest backup.

Why wrong: Restoring from backup should only be done if the array is unrecoverable. The array is degraded but still online; a rebuild is faster and preserves recent data.

Check the RAID controller battery and cache.

Why wrong: A faulty battery or cache can prevent automatic rebuilds, but it is a secondary consideration. The primary goal is to eliminate the failed disk to avoid data loss.

Replace the hot spare with a new disk.

Why wrong: The hot spare is functioning hardware; the problem is that the array did not automatically use it. Swapping the spare does not solve the underlying rebuild trigger issue.

Implement SSH key authentication only.

Why wrong: SSH keys strengthen authentication against password guessing but do not meet the multifactor requirement, as the key itself is a single factor.

Use SSH with public key authentication and install fail2ban.

Why wrong: This combination improves resistance to brute-force attacks but still lacks the mandatory second factor of authentication.

Enable RDP with network-level authentication.

Why wrong: RDP is not typically considered secure for server administration without additional protections, and NLA is a single-factor authentication method.

Perform a full backup more frequently.

Why wrong: Frequency does not ensure the backups themselves are free from corruption; a corrupted backup is still corrupted regardless of how often it is made.

Switch to disk-based backups exclusively.

Why wrong: Disk-based backups are not immune to corruption (e.g., silent data corruption, file system errors) and still require verification procedures.

Store backup tapes offsite only after verification.

Why wrong: This ensures initial readability but does not protect against later degradation or corruption that can occur during storage.

Run an antivirus scan.

Why wrong: Antivirus scans quarantine or delete files, altering the disk state and potentially destroying forensic evidence needed to understand the attack.

Reboot the server in safe mode.

Why wrong: Rebooting, even in safe mode, clears memory and may activate malware that has installed boot-time persistence, hindering investigation.

Power off the server immediately.

Why wrong: Shutting down the system results in the loss of all volatile data (memory, network state), which is often crucial for forensic analysis.